[TAP5-2327] The Cookies interface should provide an option to mark cookies as httpOnly

• Type: New Feature
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 5.3.7, 5.4
• Fix Version/s: 5.5.0
• Component/s: tapestry-core
• Labels: desired_for_5.5 patch
• Assignee: Jochen Kemnade
• Reporter: Martin Schneider
• Created: 29/Apr/14 09:26
• Updated: 14/Jul/16 06:09
• Resolved: 14/Jul/16 05:46

Description

Since Servlet 3.0 there is an option to mark cookies as httpOnly via javax.servlet.http.Cookie.setHttpOnly(boolean). There should be an option to use that in org.apache.tapestry5.services.Cookies. In 5.3.7 the default implementation does not set the httpOnly flag.

Issue Links

• is blocked by: TAP5-2548 Upgrade embedded Jetty and Tomcat versions